Secure AF

The episode packs substantive technical content on ad-based tracking, data brokers, Stingray devices, and ALPRs with concrete mechanisms, but dilutes impact with conversational filler, repetition, and casual throat-clearing throughout. Strong middle sections (SDKs, location data pipelines, law enforcement purchases) are offset by meandering tangents and restatement of points already covered.

“They're buying data from ad tech companies, um, and they're tracking movements and routines. They're identifying um a lot of different stuff. This is like historical location data that can go back like several years. Um, it's no hacking required on this. It's they're just buying access.”

“They have profiles on individuals walking, biking, things like that for vehicles, which is obviously the main thing. It's not just license plate, they keep a profile of vehicles. So if you don't have a license plate, they can still identify that vehicle, they can still give it a profile.”

The core framing - tracking vs. hacking - is useful but not particularly novel; the Target pregnancy example is a well-known data point. The introduction of "ad-int" as terminology is a minor original contribution. Most frameworks (SDKs, data brokers, OSINT for red teaming) are standard security knowledge presented competently but without fresh angles or counterintuitive conclusions.

“We're gonna call this ad int. So this is advertising intelligence because that's exactly what it is, and it would be used the exact same way.”

“Target knew that she was pregnant before she did.”

One guest is a director of marketing at a cybersecurity firm (Alias) with hands-on experience in red teaming, physical penetration testing, and real OSINT work; the other appears to be a senior technical security practitioner with deep knowledge of SDKs, malware, and law enforcement surveillance methods. Both are practitioners with genuine operational experience, not career podcasters or pure theorists. However, neither appears to be a major industry figure or executive at a household-name company.

“I'm at alias here, I'm the director of marketing, um, and I do a lot of ad int”

“I've seen this a lot of times too with apps where it's like they're on the store and then they're taken offline and now they're being distributed directly through the original creator.”

The episode names specific tools (Weblock/Pen Link, Pi-hole, Stingray, ALPR, Ray Hunter) and references real entities (Citizen Lab, ICE, US military, Texas DPS, Hungarian intelligence), but lacks hard numbers on scale, cost, or impact. The Target pregnancy case is anecdotal. Red-teaming examples are generic (coffee shop Wi-Fi pineapple). Missing specific metrics on data broker pricing, API costs, or documented breach counts that would elevate specificity.

“Citizen Lab confirmed ICE is using it, US t US military organizations, uh Texas DPS, a bunch of local police departments, a bunch of district attorneys, um, some other uh countries, uh El Salvador National Police, Hungarian intelligence services”

“There's a system, it's called Weblock. Um, it uses data from mobile apps and digital advertising um to track people's locations and behaviors at massive scale. Um, and it can monitor up to millions of devices globally”

The host asks reasonable open-ended questions and attempts follow-ups, but rarely pushes back on claims, misses opportunities to challenge or clarify (e.g., "is buying data fundamentally different from surveillance?" gets a non-answer that isn't probed). Tangents proliferate without discipline; the lightning round is fun but superficial. Lacks the sharpness to extract deeper reasoning or evidence from guests.

“So let me ask you this is buying data fundamentally different from surveillance? Uh data is simply data, the usage is what defines what it is, I guess.”

“So um what are some like high impact steps and things that you can do?”